Handle XHR on reset password #6141

Misuse of location header. Redirect is `302`

Badly mixing `4xx` and `3xx`